RBI enables Card-on-File token creation facility directly at the issuer bank level

Reserve Bank of India

The Reserve Bank of India (RBI) December 20 said that it has decided to enable Card-on-File Tokenisation (CoFT) directly through card-issuing banks/institutions.

The central bank said this will provide cardholders with an additional choice to tokenise their cards for multiple merchant sites through a single process.

Before this, a Card-on-File (CoF) token could only be created through the merchant’s application or webpage.

In the October monetary policy, the RBI proposed to introduce CoF token creation facilities directly at the issuer bank level.

“This measure will enhance convenience for cardholders to get tokens created and linked to their existing accounts with various e-commerce applications,” RBI said in October.

The central bank introduced CoFT in September 2021 and began implementation on October 1, 2022.

As per October monetary policy, so far, over 56 crore tokens have been created on which transactions with a value of over Rs 5 lakh crore have been undertaken. Tokenisation has improved transaction security and transaction approval rates.

The central bank has also given requirements for CoFT through card issuers, which consists of generation of CoF Tokens for a card, through the card issuer, can be enabled through mobile banking and internet banking channels.

CoFT generation shall be done only on explicit customer consent, and with AFA validation. If the cardholder selects multiple merchants for which to tokenise his/her card, AFA validation may be combined for all these merchants.

The tokens thus generated shall be made available on the merchant’s payment page, in the cardholder’s account with the merchant, RBI said.

The cardholder may tokenise the card at any time of his convenience, either on receipt of the new card or later, and the card issuer shall provide a complete list of merchants for whom it can provide tokenisation services. The cardholders shall select the merchants with whom he/she wishes to maintain tokens. (Alternatively – “The cardholder can make his selection from the list”), central bank said.

The release also said that the card token so issued may be either by the card network or the issuer or both.